@yielded/auth-persistence 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/OAuthPersistence.mjs

@@ -1,22 +1,28 @@
 import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
 import { PersistenceConfigurationError } from "./internal/configuration.mjs";
-import { Fragment, Table } from "./internal/sql-table.mjs";
+import { Table } from "./internal/sql-table.mjs";
+import { SqlExpression, and, eq, sql } from "./internal/sql-expression.mjs";
 import { makeNativeSqlTables } from "./internal/native-sql-table.mjs";
 import { requireStandalone } from "./internal/standalone.mjs";
-import { NativeDatabase } from "./internal/transaction-kernel.mjs";
-import { CurrentSessionSql, makeSessionKernel } from "./internal/session-kernel.mjs";
-import { and, eq, makeSqlDatabase, sql, sqlQueryOperations } from "./internal/sql-query.mjs";
-import { requiredOAuthAccountsConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints } from "./internal/models/oauth-model.mjs";
-import { makeOAuthKernel } from "./internal/oauth-kernel.mjs";
+import { makeSqlCommitExecutor } from "./internal/sql-commit.mjs";
+import { requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints } from "./internal/models/oauth-model.mjs";
+import { captureOAuthMapping } from "./internal/oauth/state.mjs";
+import { makeNativeOAuthSignInServices } from "./internal/oauth/native-sign-in.mjs";
+import { makeNativeOAuthAccountsServices } from "./internal/oauth/native-accounts.mjs";
+import { makeNativeOAuthConnectedServices } from "./internal/oauth/native-connected.mjs";
+import { makeNativeOAuthRegistrationIntentServices, makeNativeOAuthRegistrationServices } from "./internal/oauth/native-registration.mjs";
+import { makeNativeOAuthRevocationServices } from "./internal/oauth/native-revocations.mjs";
 import { validateSqlStorage } from "./internal/sql-storage-validation.mjs";
-import { oauthCleanupTable, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationGuardTable } from "./internal/sql-oauth-model.mjs";
+import { oauthCleanupTable, oauthEligibilityTable, oauthRegistrationGuardTable } from "./internal/sql-oauth-model.mjs";
 import { requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints } from "./internal/models/oauth-connected-model.mjs";
-import { oauthConnectedPolicyGuard } from "./internal/sql-oauth-connected-model.mjs";
+import { oauthAccountsPersistenceLayer, oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer, oauthRegistrationAuthorityLayer, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer } from "./internal/oauth/native-layers.mjs";
+import { makeAuthenticationAuthorityServices } from "./internal/sql-authority.mjs";
 import { Effect, Predicate, Schema } from "effect";
 import { SqlClient } from "effect/sql";
-import { SessionUnavailable } from "@yielded/auth/Sessions";
+import { hasCommitScope } from "@yielded/auth/Hooks";
 import { OAuthAccountsPersistence, OAuthConnectedPersistence, OAuthConnectedRevocations, OAuthRegistrationIntents, OAuthSignInPersistence, OAuthUnavailable } from "@yielded/auth/OAuth";
 //#region src/OAuthPersistence.ts
+/** Direct PostgreSQL and SQLite owners for upstream OAuth. Provider exchange stays outside these transactions. */
 var OAuthPersistence_exports = /* @__PURE__ */ __exportAll({
 	and: () => and,
 	clock: () => clock,
@@ -38,88 +44,74 @@ var OAuthPersistence_exports = /* @__PURE__ */ __exportAll({
 	oauthCleanupTable: () => oauthCleanupTable,
 	oauthConnectedOwnershipReferences: () => oauthConnectedOwnershipReferences,
 	oauthConnectedPersistenceLayer: () => oauthConnectedPersistenceLayer,
-	oauthConnectedPolicyGuard: () => oauthConnectedPolicyGuard,
 	oauthConnectedRevocationsLayer: () => oauthConnectedRevocationsLayer,
 	oauthEligibilityTable: () => oauthEligibilityTable,
-	oauthReferenceGuardTable: () => oauthReferenceGuardTable,
 	oauthRegistrationAuthorityLayer: () => oauthRegistrationAuthorityLayer,
 	oauthRegistrationGuardTable: () => oauthRegistrationGuardTable,
 	oauthRegistrationIntentsLayer: () => oauthRegistrationIntentsLayer,
 	oauthSignInPersistenceLayer: () => oauthSignInPersistenceLayer,
-	requiredOAuthAccountsConstraints: () => requiredOAuthAccountsConstraints,
 	requiredOAuthConnectedConstraints: () => requiredOAuthConnectedConstraints,
 	requiredOAuthConnectedRevocationConstraints: () => requiredOAuthConnectedRevocationConstraints,
 	requiredOAuthRegistrationConstraints: () => requiredOAuthRegistrationConstraints,
 	requiredOAuthSignInConstraints: () => requiredOAuthSignInConstraints,
-	requiredOAuthTupleConstraints: () => requiredOAuthTupleConstraints,
 	sql: () => sql,
 	table: () => table
 });
-/** Physical identifiers and representations only; applications own migrations. */
 const table = (definition) => new Table(definition.name, definition.columns, definition.unique, definition.schema);
-/** Integer-millisecond engine clock, sampled after locks on either supported dialect. */
 const clock = {
 	encodeInstant: Schema.encodeSync(Schema.Int),
 	decodeInstant: Schema.decodeUnknownSync(Schema.Int),
-	engineNowMillis: new Fragment((compiler) => compiler.dialect === "pg" ? "cast(extract(epoch from clock_timestamp()) * 1000 as bigint)" : "cast(round((julianday('now') - 2440587.5) * 86400000) as integer)")
-};
-const operations = {
-	...sqlQueryOperations,
-	validateStorage: validateSqlStorage
-};
-const kernels = {
-	pg: makeOAuthKernel(operations, () => "pg"),
-	sqlite: makeOAuthKernel(operations, () => "sqlite")
+	engineNowMillis: new SqlExpression((client) => client.onDialectOrElse({
+		pg: () => client`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`,
+		orElse: () => client`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`
+	})),
+	toMillis: (expression) => expression,
+	fromMillis: (expression) => expression
 };
 const acquire = Effect.gen(function* () {
 	const client = yield* SqlClient.SqlClient;
-	const dialect = client.onDialectOrElse({
-		pg: () => "pg",
-		sqlite: () => "sqlite",
-		orElse: () => void 0
-	});
-	if (dialect === void 0 || Predicate.hasProperty(client, "~@effect/sql-d1/D1Client")) return yield* PersistenceConfigurationError.make({ reason: "OAuth persistence requires PostgreSQL or SQLite with interactive transactions" });
+	if (!client.onDialectOrElse({
+		pg: () => true,
+		sqlite: () => true,
+		orElse: () => false
+	}) || Predicate.hasProperty(client, "~@effect/sql-d1/D1Client")) return yield* PersistenceConfigurationError.make({ reason: "OAuth persistence requires PostgreSQL or SQLite with interactive transactions" });
 	return {
-		database: yield* makeSqlDatabase(dialect),
-		configuration: {
-			mode: "interactive",
-			dialect,
-			locking: dialect === "pg",
-			standaloneGuard: (service) => requireStandalone(() => OAuthUnavailable.make({}), service)
-		},
-		kernel: kernels[dialect]
+		client,
+		tables: makeNativeSqlTables(client)
 	};
 });
-const using = (body) => Effect.flatMap(acquire, (input) => body(input).pipe(Effect.provideService(NativeDatabase, input.database)));
-const makeOAuthSignInServices = (mapping) => using(({ kernel, configuration }) => kernel.target.makeTargetOAuthSignInServices(mapping, configuration));
-/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
-const coordinateOAuthSignIn = (options, body) => using(({ kernel, configuration, database }) => kernel.target.coordinateTargetOAuthSignIn(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, OAuthSignInPersistence, services.oauthSignInPersistence)));
-const makeOAuthRegistrationIntentServices = (mapping) => using(({ kernel, configuration }) => kernel.target.makeTargetOAuthRegistrationIntentServices(mapping, configuration));
-/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
-const coordinateOAuthRegistrationIntents = (options, body) => using(({ kernel, configuration, database }) => kernel.target.coordinateTargetOAuthRegistrationIntents(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, OAuthRegistrationIntents, services.oauthRegistrationIntents)));
-const makeOAuthAccountsServices = (mapping) => using(({ kernel, configuration }) => kernel.target.makeTargetOAuthAccountsServices(mapping, configuration));
-/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
-const coordinateOAuthAccounts = (options, body) => using(({ kernel, configuration, database }) => kernel.target.coordinateTargetOAuthAccounts(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, OAuthAccountsPersistence, services.oauthAccountsPersistence)));
-const makeOAuthConnectedServices = (mapping) => using(({ kernel, configuration }) => kernel.connectedTarget.makeTargetOAuthConnectedServices(mapping, configuration));
-/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
-const coordinateOAuthConnected = (options, body) => using(({ kernel, configuration, database }) => kernel.connectedTarget.coordinateTargetOAuthConnected(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, OAuthConnectedPersistence, services.oauthConnectedPersistence)));
-const makeOAuthConnectedRevocationServices = (mapping) => using(({ kernel, configuration }) => kernel.connectedTarget.makeTargetOAuthConnectedRevocationServices(mapping, configuration));
-/** Run auth and application SQL in one adapter-owned transaction and commit journal. */
-const coordinateOAuthConnectedRevocations = (options, body) => using(({ kernel, configuration, database }) => kernel.connectedTarget.coordinateTargetOAuthConnectedRevocations(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, OAuthConnectedRevocations, services.oauthConnectedRevocations)));
-const makeOAuthRegistrationServices = (mapping) => using(({ kernel, configuration }) => kernel.target.makeTargetOAuthRegistrationServices(mapping, configuration));
-const coordinateOAuthRegistration = (options, body) => using(({ kernel, configuration, database }) => kernel.target.coordinateTargetOAuthRegistration(database, options.mapping, configuration, (_transaction, services) => Effect.provideService(body, options.target, services.registrationAuthority)));
-/** Include these guards when login ownership may also hold retained grants. */
-const oauthConnectedOwnershipReferences = (mapping, dialect) => kernels[dialect].connectedReference.oauthConnectedOwnershipReferences(mapping);
-const { oauthAccountsPersistenceLayer, oauthSignInPersistenceLayer, oauthRegistrationIntentsLayer, oauthRegistrationAuthorityLayer } = kernels.sqlite.target;
-const { oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer } = kernels.sqlite.connectedTarget;
-/** Shared session issuance must validate the same subject and credential authority
-* as OAuth. Supply this service when it is not already provided by session storage. */
-const makeAuthenticationAuthorityServices = (mapping) => using(({ database, configuration }) => makeSessionKernel(operations, (client) => makeNativeSqlTables(client)).makeSqlAuthenticationAuthority(mapping, {
-	mode: "interactive",
-	locking: configuration.locking,
-	standaloneGuard: requireStandalone(() => SessionUnavailable.make({}), database.$client.transactionService)
-}).pipe(Effect.provideService(CurrentSessionSql, database), Effect.map((authenticationAuthority) => ({ authenticationAuthority }))));
+const using = (original, make) => Effect.gen(function* () {
+	const target = yield* acquire;
+	const mapping = captureOAuthMapping(original);
+	yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => OAuthUnavailable.make({})));
+	return yield* make(target.tables, mapping);
+});
+const coordinate = (make, body) => Effect.gen(function* () {
+	const { client } = yield* acquire;
+	if (yield* hasCommitScope) return yield* OAuthUnavailable.make({});
+	yield* requireStandalone(() => OAuthUnavailable.make({}), client.transactionService);
+	return yield* (yield* makeSqlCommitExecutor(() => OAuthUnavailable.make({}))).coordinate(Effect.flatMap(make.pipe(Effect.mapError(() => OAuthUnavailable.make({}))), body));
+});
+const makeOAuthSignInServices = (mapping) => using(mapping, (tables, value) => makeNativeOAuthSignInServices(tables, value));
+const coordinateOAuthSignIn = (options, body) => coordinate(makeOAuthSignInServices(options.mapping), (services) => Effect.provideService(body, OAuthSignInPersistence, services.oauthSignInPersistence));
+const makeOAuthAccountsServices = (mapping) => using(mapping, (tables, value) => makeNativeOAuthAccountsServices(tables, value));
+const coordinateOAuthAccounts = (options, body) => coordinate(makeOAuthAccountsServices(options.mapping), (services) => Effect.provideService(body, OAuthAccountsPersistence, services.oauthAccountsPersistence));
+const makeOAuthRegistrationIntentServices = (mapping) => using(mapping, (tables, value) => makeNativeOAuthRegistrationIntentServices(tables, value));
+const coordinateOAuthRegistrationIntents = (options, body) => coordinate(makeOAuthRegistrationIntentServices(options.mapping), (services) => Effect.provideService(body, OAuthRegistrationIntents, services.oauthRegistrationIntents));
+const makeOAuthConnectedServices = (mapping) => using(mapping, (tables, value) => makeNativeOAuthConnectedServices(tables, value));
+const coordinateOAuthConnected = (options, body) => coordinate(makeOAuthConnectedServices(options.mapping), (services) => Effect.provideService(body, OAuthConnectedPersistence, services.oauthConnectedPersistence));
+const makeOAuthConnectedRevocationServices = (mapping) => using(mapping, (tables, value) => makeNativeOAuthRevocationServices(tables, value));
+const coordinateOAuthConnectedRevocations = (options, body) => coordinate(makeOAuthConnectedRevocationServices(options.mapping), (services) => Effect.provideService(body, OAuthConnectedRevocations, services.oauthConnectedRevocations));
+const makeOAuthRegistrationServices = (mapping) => using(mapping, (tables, value) => makeNativeOAuthRegistrationServices(tables, value));
+const coordinateOAuthRegistration = (options, body) => coordinate(makeOAuthRegistrationServices(options.mapping), (services) => Effect.provideService(body, options.target, services.registrationAuthority));
+const oauthConnectedOwnershipReferences = (mapping) => ({ connectedReference: (input) => {
+	const g = mapping.grant;
+	const grant = sql`exists(select 1 from ${g.table} where ${g.table.columns[g.identityKey]} = ${input.identityKey} and ${g.table.columns[g.subjectId]} = ${input.subjectId})`;
+	if (mapping.revocation.mode === "unsupported") return grant;
+	const j = mapping.revocation.job;
+	return sql`(${grant}) or exists(select 1 from ${j.table} where ${j.table.columns[j.identityKey]} = ${input.identityKey} and ${j.table.columns[j.subjectId]} = ${input.subjectId})`;
+} });
 //#endregion
-export { OAuthPersistence_exports, and, clock, coordinateOAuthAccounts, coordinateOAuthConnected, coordinateOAuthConnectedRevocations, coordinateOAuthRegistration, coordinateOAuthRegistrationIntents, coordinateOAuthSignIn, eq, makeAuthenticationAuthorityServices, makeOAuthAccountsServices, makeOAuthConnectedRevocationServices, makeOAuthConnectedServices, makeOAuthRegistrationIntentServices, makeOAuthRegistrationServices, makeOAuthSignInServices, oauthAccountsPersistenceLayer, oauthCleanupTable, oauthConnectedOwnershipReferences, oauthConnectedPersistenceLayer, oauthConnectedPolicyGuard, oauthConnectedRevocationsLayer, oauthEligibilityTable, oauthReferenceGuardTable, oauthRegistrationAuthorityLayer, oauthRegistrationGuardTable, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer, requiredOAuthAccountsConstraints, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, requiredOAuthTupleConstraints, sql, table };
+export { OAuthPersistence_exports, and, clock, coordinateOAuthAccounts, coordinateOAuthConnected, coordinateOAuthConnectedRevocations, coordinateOAuthRegistration, coordinateOAuthRegistrationIntents, coordinateOAuthSignIn, eq, makeAuthenticationAuthorityServices, makeOAuthAccountsServices, makeOAuthConnectedRevocationServices, makeOAuthConnectedServices, makeOAuthRegistrationIntentServices, makeOAuthRegistrationServices, makeOAuthSignInServices, oauthAccountsPersistenceLayer, oauthCleanupTable, oauthConnectedOwnershipReferences, oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer, oauthEligibilityTable, oauthRegistrationAuthorityLayer, oauthRegistrationGuardTable, oauthRegistrationIntentsLayer, oauthSignInPersistenceLayer, requiredOAuthConnectedConstraints, requiredOAuthConnectedRevocationConstraints, requiredOAuthRegistrationConstraints, requiredOAuthSignInConstraints, sql, table };
 
 //# sourceMappingURL=OAuthPersistence.mjs.map

package/dist/OAuthPersistence.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"OAuthPersistence.mjs","names":[],"sources":["../src/OAuthPersistence.ts"],"sourcesContent":["/** Direct Effect SQL persistence for upstream OAuth accounts. PostgreSQL and SQLite\n * require interactive transactions; provider exchanges occur outside coordinators. */\nimport type { LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthAccountsPersistence,\n  OAuthSignInPersistence,\n  OAuthRegistrationIntents,\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport type { AuthenticationAuthority } from \"@yielded/auth/Sessions\";\nimport { SessionUnavailable } from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, Effect, Predicate, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceConfigurationError } from \"./internal/configuration\";\nimport type { AuthenticationAuthorityMapping as AuthorityMapping } from \"./internal/models/session-model\";\nimport { makeNativeSqlTables } from \"./internal/native-sql-table\";\nimport { makeOAuthKernel } from \"./internal/oauth-kernel\";\nimport type { OAuthCoordinatorError, OAuthTargetConfiguration } from \"./internal/oauth/target\";\nimport {\n  CurrentSessionSql,\n  makeSessionKernel,\n  type SessionSqlDatabase,\n} from \"./internal/session-kernel\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./internal/sql-oauth-connected-model\";\nimport type {\n  SqlTableModel,\n  OAuthAccountsMapping,\n  OAuthSignInMapping,\n  OAuthRegistrationIntentMapping,\n  OAuthRegistrationMapping,\n  OAuthRegistrationAuthority,\n  OAuthReferenceGuardDescriptor,\n} from \"./internal/sql-oauth-model\";\nimport { makeSqlDatabase, sqlQueryOperations, sql } from \"./internal/sql-query\";\nimport { validateSqlStorage } from \"./internal/sql-storage-validation\";\nimport { Table, Fragment } from \"./internal/sql-table\";\nimport { requireStandalone } from \"./internal/standalone\";\nimport type { StorageTable } from \"./internal/storage-tables\";\nimport { NativeDatabase } from \"./internal/transaction-kernel\";\nimport type { TransactionNativeDatabase } from \"./internal/transaction-kernel\";\nexport * from \"./internal/sql-oauth-model\";\nexport * from \"./internal/sql-oauth-connected-model\";\nexport { sql };\nexport { and, eq } from \"./internal/sql-query\";\n\n/** Physical identifiers and representations only; applications own migrations. */\nexport const table = (definition: StorageTable) =>\n  new Table(definition.name, definition.columns, definition.unique, definition.schema);\n\n/** Integer-millisecond engine clock, sampled after locks on either supported dialect. */\nexport const clock = {\n  encodeInstant: Schema.encodeSync(Schema.Int),\n  decodeInstant: Schema.decodeUnknownSync(Schema.Int),\n  engineNowMillis: new Fragment((compiler) =>\n    compiler.dialect === \"pg\"\n      ? \"cast(extract(epoch from clock_timestamp()) * 1000 as bigint)\"\n      : \"cast(round((julianday('now') - 2440587.5) * 86400000) as integer)\",\n  ),\n};\n\nconst operations = { ...sqlQueryOperations, validateStorage: validateSqlStorage };\n\nconst kernels = {\n  pg: makeOAuthKernel(operations, () => \"pg\"),\n  sqlite: makeOAuthKernel(operations, () => \"sqlite\"),\n};\n\nconst acquire = Effect.gen(function* () {\n  const client = yield* SqlClient.SqlClient;\n\n  const dialect = client.onDialectOrElse({\n    pg: () => \"pg\" as const,\n    sqlite: () => \"sqlite\" as const,\n    orElse: () => undefined,\n  });\n\n  // D1 exposes the SQLite compiler but its public driver brand identifies a\n  // batch-only client. Keep the default package free of a D1 runtime dependency.\n  if (dialect === undefined || Predicate.hasProperty(client, \"~@effect/sql-d1/D1Client\"))\n    return yield* PersistenceConfigurationError.make({\n      reason: \"OAuth persistence requires PostgreSQL or SQLite with interactive transactions\",\n    });\n\n  const database = yield* makeSqlDatabase(dialect);\n\n  const configuration: OAuthTargetConfiguration = {\n    mode: \"interactive\",\n    dialect,\n    locking: dialect === \"pg\",\n    standaloneGuard: (service) => requireStandalone(() => OAuthUnavailable.make({}), service),\n  };\n\n  // Erase only the query-builder handle; batch methods are never selected by this adapter.\n  return {\n    database: database as unknown as TransactionNativeDatabase,\n    configuration,\n    kernel: kernels[dialect],\n  };\n});\n\nconst using = <A, E, R>(body: (input: Effect.Success<typeof acquire>) => Effect.Effect<A, E, R>) =>\n  Effect.flatMap(acquire, (input) =>\n    body(input).pipe(Effect.provideService(NativeDatabase, input.database)),\n  );\n\nexport const makeOAuthSignInServices = <N>(\n  mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.target.makeTargetOAuthSignInServices(mapping, configuration),\n  );\n\n/** Run auth and application SQL in one adapter-owned transaction and commit journal. */\nexport const coordinateOAuthSignIn = <N, A, E, R>(\n  options: { readonly mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, OAuthSignInPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.target.coordinateTargetOAuthSignIn(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, OAuthSignInPersistence, services.oauthSignInPersistence),\n    ),\n  );\n\nexport const makeOAuthRegistrationIntentServices = <N>(\n  mapping: OAuthRegistrationIntentMapping<Table, Table, Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.target.makeTargetOAuthRegistrationIntentServices(mapping, configuration),\n  );\n\n/** Run auth and application SQL in one adapter-owned transaction and commit journal. */\nexport const coordinateOAuthRegistrationIntents = <N, A, E, R>(\n  options: {\n    readonly mapping: OAuthRegistrationIntentMapping<\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      N\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, OAuthRegistrationIntents> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.target.coordinateTargetOAuthRegistrationIntents(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, OAuthRegistrationIntents, services.oauthRegistrationIntents),\n    ),\n  );\n\nexport const makeOAuthAccountsServices = <N>(\n  mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.target.makeTargetOAuthAccountsServices(mapping, configuration),\n  );\n\n/** Run auth and application SQL in one adapter-owned transaction and commit journal. */\nexport const coordinateOAuthAccounts = <N, A, E, R>(\n  options: {\n    readonly mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, Table, Table, N>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, OAuthAccountsPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.target.coordinateTargetOAuthAccounts(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, OAuthAccountsPersistence, services.oauthAccountsPersistence),\n    ),\n  );\n\nexport const makeOAuthConnectedServices = <N>(\n  mapping: OAuthConnectedMapping<\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    N,\n    Table\n  >,\n): Effect.Effect<\n  { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.connectedTarget.makeTargetOAuthConnectedServices(mapping, configuration),\n  );\n\n/** Run auth and application SQL in one adapter-owned transaction and commit journal. */\nexport const coordinateOAuthConnected = <N, A, E, R>(\n  options: {\n    readonly mapping: OAuthConnectedMapping<\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      N,\n      Table\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, OAuthConnectedPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.connectedTarget.coordinateTargetOAuthConnected(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, OAuthConnectedPersistence, services.oauthConnectedPersistence),\n    ),\n  );\n\nexport const makeOAuthConnectedRevocationServices = <N>(\n  mapping: OAuthConnectedRevocationMapping<Table, Table, Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.connectedTarget.makeTargetOAuthConnectedRevocationServices(mapping, configuration),\n  );\n\n/** Run auth and application SQL in one adapter-owned transaction and commit journal. */\nexport const coordinateOAuthConnectedRevocations = <N, A, E, R>(\n  options: {\n    readonly mapping: OAuthConnectedRevocationMapping<\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      N\n    >;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, OAuthConnectedRevocations> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.connectedTarget.coordinateTargetOAuthConnectedRevocations(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, OAuthConnectedRevocations, services.oauthConnectedRevocations),\n    ),\n  );\n\nexport const makeOAuthRegistrationServices = <Registration, N>(\n  mapping: OAuthRegistrationMapping<\n    Registration,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    N\n  >,\n): Effect.Effect<\n  { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration }) =>\n    kernel.target.makeTargetOAuthRegistrationServices<Registration>(mapping, configuration),\n  );\n\nexport const coordinateOAuthRegistration = <Id, Registration, N, A, E, R>(\n  options: {\n    readonly mapping: OAuthRegistrationMapping<\n      NoInfer<Registration>,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      N\n    >;\n    readonly target: Context.Key<Id, OAuthRegistrationAuthority<Registration>>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  OAuthCoordinatorError<E> | PersistenceConfigurationError,\n  Exclude<R, Id> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ kernel, configuration, database }) =>\n    kernel.target.coordinateTargetOAuthRegistration<Registration, unknown, A, E, Exclude<R, Id>>(\n      database,\n      options.mapping,\n      configuration,\n      (_transaction, services) =>\n        Effect.provideService(body, options.target, services.registrationAuthority),\n    ),\n  );\n\n/** Include these guards when login ownership may also hold retained grants. */\nexport const oauthConnectedOwnershipReferences = <N>(\n  mapping: OAuthConnectedMapping<\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    Table,\n    N,\n    Table\n  >,\n  dialect: \"pg\" | \"sqlite\",\n) =>\n  // The selected compiler supplies Fragment handles; domain values retain their codecs.\n  kernels[dialect].connectedReference.oauthConnectedOwnershipReferences(mapping) as {\n    readonly connectedReferenceGuards: ReadonlyArray<OAuthReferenceGuardDescriptor<N>>;\n    readonly connectedReference: (input: {\n      readonly identityKey: string;\n      readonly subjectId: N;\n    }) => Fragment;\n  };\n\nexport const {\n  oauthAccountsPersistenceLayer,\n  oauthSignInPersistenceLayer,\n  oauthRegistrationIntentsLayer,\n  oauthRegistrationAuthorityLayer,\n} = kernels.sqlite.target;\n\nexport const { oauthConnectedPersistenceLayer, oauthConnectedRevocationsLayer } =\n  kernels.sqlite.connectedTarget;\n\n/** Shared session issuance must validate the same subject and credential authority\n * as OAuth. Supply this service when it is not already provided by session storage. */\nexport const makeAuthenticationAuthorityServices = <Claims, N>(\n  mapping: AuthorityMapping<Claims, SqlTableModel, SqlTableModel, SqlTableModel, SqlTableModel, N>,\n): Effect.Effect<\n  { readonly authenticationAuthority: AuthenticationAuthority[\"Service\"] },\n  SessionUnavailable | PersistenceConfigurationError,\n  LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(({ database, configuration }) =>\n    makeSessionKernel(operations, (client) => makeNativeSqlTables(client))\n      .makeSqlAuthenticationAuthority(mapping, {\n        mode: \"interactive\",\n        locking: configuration.locking,\n        standaloneGuard: requireStandalone(\n          () => SessionUnavailable.make({}),\n          database.$client.transactionService,\n        ),\n      })\n      .pipe(\n        // Both kernels capture the same raw SQL query-builder handle and client.\n        Effect.provideService(CurrentSessionSql, database as unknown as SessionSqlDatabase),\n        Effect.map((authenticationAuthority) => ({ authenticationAuthority })),\n      ),\n  );\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDA,MAAa,SAAS,eACpB,IAAI,MAAM,WAAW,MAAM,WAAW,SAAS,WAAW,QAAQ,WAAW,MAAM;;AAGrF,MAAa,QAAQ;CACnB,eAAe,OAAO,WAAW,OAAO,GAAG;CAC3C,eAAe,OAAO,kBAAkB,OAAO,GAAG;CAClD,iBAAiB,IAAI,UAAU,aAC7B,SAAS,YAAY,OACjB,iEACA,mEACN;AACF;AAEA,MAAM,aAAa;CAAE,GAAG;CAAoB,iBAAiB;AAAmB;AAEhF,MAAM,UAAU;CACd,IAAI,gBAAgB,kBAAkB,IAAI;CAC1C,QAAQ,gBAAgB,kBAAkB,QAAQ;AACpD;AAEA,MAAM,UAAU,OAAO,IAAI,aAAa;CACtC,MAAM,SAAS,OAAO,UAAU;CAEhC,MAAM,UAAU,OAAO,gBAAgB;EACrC,UAAU;EACV,cAAc;EACd,cAAc,KAAA;CAChB,CAAC;CAID,IAAI,YAAY,KAAA,KAAa,UAAU,YAAY,QAAQ,0BAA0B,GACnF,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,gFACV,CAAC;CAYH,OAAO;EACL,UAAU,OAXY,gBAAgB,OAAO;EAY7C,eAAA;GATA,MAAM;GACN;GACA,SAAS,YAAY;GACrB,kBAAkB,YAAY,wBAAwB,iBAAiB,KAAK,CAAC,CAAC,GAAG,OAAO;EAM5E;EACZ,QAAQ,QAAQ;CAClB;AACF,CAAC;AAED,MAAM,SAAkB,SACtB,OAAO,QAAQ,UAAU,UACvB,KAAK,KAAK,CAAC,CAAC,KAAK,OAAO,eAAe,gBAAgB,MAAM,QAAQ,CAAC,CACxE;AAEF,MAAa,2BACX,YAMA,OAAO,EAAE,QAAQ,oBACf,OAAO,OAAO,8BAA8B,SAAS,aAAa,CACpE;;AAGF,MAAa,yBACX,SACA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,OAAO,4BACZ,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,wBAAwB,SAAS,sBAAsB,CACvF,CACF;AAEF,MAAa,uCACX,YAMA,OAAO,EAAE,QAAQ,oBACf,OAAO,OAAO,0CAA0C,SAAS,aAAa,CAChF;;AAGF,MAAa,sCACX,SAYA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,OAAO,yCACZ,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,0BAA0B,SAAS,wBAAwB,CAC3F,CACF;AAEF,MAAa,6BACX,YAMA,OAAO,EAAE,QAAQ,oBACf,OAAO,OAAO,gCAAgC,SAAS,aAAa,CACtE;;AAGF,MAAa,2BACX,SAGA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,OAAO,8BACZ,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,0BAA0B,SAAS,wBAAwB,CAC3F,CACF;AAEF,MAAa,8BACX,YAmBA,OAAO,EAAE,QAAQ,oBACf,OAAO,gBAAgB,iCAAiC,SAAS,aAAa,CAChF;;AAGF,MAAa,4BACX,SAgBA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,gBAAgB,+BACrB,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,2BAA2B,SAAS,yBAAyB,CAC7F,CACF;AAEF,MAAa,wCACX,YAMA,OAAO,EAAE,QAAQ,oBACf,OAAO,gBAAgB,2CAA2C,SAAS,aAAa,CAC1F;;AAGF,MAAa,uCACX,SAYA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,gBAAgB,0CACrB,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,2BAA2B,SAAS,yBAAyB,CAC7F,CACF;AAEF,MAAa,iCACX,YAgBA,OAAO,EAAE,QAAQ,oBACf,OAAO,OAAO,oCAAkD,SAAS,aAAa,CACxF;AAEF,MAAa,+BACX,SAcA,SAMA,OAAO,EAAE,QAAQ,eAAe,eAC9B,OAAO,OAAO,kCACZ,UACA,QAAQ,SACR,gBACC,cAAc,aACb,OAAO,eAAe,MAAM,QAAQ,QAAQ,SAAS,qBAAqB,CAC9E,CACF;;AAGF,MAAa,qCACX,SAcA,YAGA,QAAQ,QAAQ,CAAC,mBAAmB,kCAAkC,OAAO;AAQ/E,MAAa,EACX,+BACA,6BACA,+BACA,oCACE,QAAQ,OAAO;AAEnB,MAAa,EAAE,gCAAgC,mCAC7C,QAAQ,OAAO;;;AAIjB,MAAa,uCACX,YAMA,OAAO,EAAE,UAAU,oBACjB,kBAAkB,aAAa,WAAW,oBAAoB,MAAM,CAAC,CAAC,CACnE,+BAA+B,SAAS;CACvC,MAAM;CACN,SAAS,cAAc;CACvB,iBAAiB,wBACT,mBAAmB,KAAK,CAAC,CAAC,GAChC,SAAS,QAAQ,kBACnB;AACF,CAAC,CAAC,CACD,KAEC,OAAO,eAAe,mBAAmB,QAAyC,GAClF,OAAO,KAAK,6BAA6B,EAAE,wBAAwB,EAAE,CACvE,CACJ"}
+{"version":3,"file":"OAuthPersistence.mjs","names":[],"sources":["../src/OAuthPersistence.ts"],"sourcesContent":["/** Direct PostgreSQL and SQLite owners for upstream OAuth. Provider exchange stays outside these transactions. */\nimport { hasCommitScope, type LifecycleHooks } from \"@yielded/auth/Hooks\";\nimport {\n  OAuthAccountsPersistence,\n  OAuthSignInPersistence,\n  OAuthRegistrationIntents,\n  OAuthConnectedPersistence,\n  OAuthConnectedRevocations,\n  OAuthUnavailable,\n} from \"@yielded/auth/OAuth\";\nimport { type Context, type Crypto, Effect, Predicate, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { PersistenceConfigurationError } from \"./internal/configuration\";\nimport { makeNativeSqlTables } from \"./internal/native-sql-table\";\nimport {\n  makeNativeOAuthAccountsServices,\n  type OAuthNativeAccountsMapping,\n} from \"./internal/oauth/native-accounts\";\nimport { makeNativeOAuthConnectedServices } from \"./internal/oauth/native-connected\";\nimport type { OAuthNativeConnectedMapping } from \"./internal/oauth/native-connected-state\";\nimport {\n  makeNativeOAuthRegistrationIntentServices,\n  makeNativeOAuthRegistrationServices,\n  type OAuthNativeRegistrationIntentMapping,\n  type OAuthNativeRegistrationMapping,\n} from \"./internal/oauth/native-registration\";\nimport {\n  makeNativeOAuthRevocationServices,\n  type OAuthNativeRevocationMapping,\n} from \"./internal/oauth/native-revocations\";\nimport { makeNativeOAuthSignInServices } from \"./internal/oauth/native-sign-in\";\nimport { type OAuthNativeReadMapping } from \"./internal/oauth/native-state\";\nimport { captureOAuthMapping } from \"./internal/oauth/state\";\nimport { makeSqlCommitExecutor } from \"./internal/sql-commit\";\nimport { sql, SqlExpression } from \"./internal/sql-expression\";\nimport type {\n  OAuthConnectedMapping,\n  OAuthConnectedRevocationMapping,\n} from \"./internal/sql-oauth-connected-model\";\nimport type {\n  OAuthAccountsMapping,\n  OAuthSignInMapping,\n  OAuthRegistrationIntentMapping,\n  OAuthRegistrationMapping,\n  OAuthRegistrationAuthority,\n} from \"./internal/sql-oauth-model\";\nimport { validateSqlStorage } from \"./internal/sql-storage-validation\";\nimport { Table } from \"./internal/sql-table\";\nimport { requireStandalone } from \"./internal/standalone\";\nimport type { StorageTable } from \"./internal/storage-tables\";\nexport * from \"./internal/sql-oauth-model\";\nexport * from \"./internal/sql-oauth-connected-model\";\nexport * from \"./internal/oauth/native-layers\";\nexport { sql, and, eq } from \"./internal/sql-expression\";\nexport { makeAuthenticationAuthorityServices } from \"./internal/sql-authority\";\n\nexport const table = (definition: StorageTable) =>\n  new Table(definition.name, definition.columns, definition.unique, definition.schema);\n\nexport const clock = {\n  encodeInstant: Schema.encodeSync(Schema.Int),\n  decodeInstant: Schema.decodeUnknownSync(Schema.Int),\n  engineNowMillis: new SqlExpression((client) =>\n    client.onDialectOrElse({\n      pg: () => client`cast(extract(epoch from clock_timestamp()) * 1000 as bigint)`,\n      orElse: () => client`cast(round((julianday('now') - 2440587.5) * 86400000) as integer)`,\n    }),\n  ),\n  toMillis: (expression: SqlExpression) => expression,\n  fromMillis: (expression: SqlExpression) => expression,\n};\n\nconst acquire = Effect.gen(function* () {\n  const client = yield* SqlClient.SqlClient;\n\n  if (\n    !client.onDialectOrElse({ pg: () => true, sqlite: () => true, orElse: () => false }) ||\n    Predicate.hasProperty(client, \"~@effect/sql-d1/D1Client\")\n  )\n    return yield* PersistenceConfigurationError.make({\n      reason: \"OAuth persistence requires PostgreSQL or SQLite with interactive transactions\",\n    });\n\n  return { client, tables: makeNativeSqlTables(client) };\n});\n\nconst using = <M, A, E, R>(\n  original: M,\n  make: (tables: ReturnType<typeof makeNativeSqlTables>, mapping: M) => Effect.Effect<A, E, R>,\n) =>\n  Effect.gen(function* () {\n    const target = yield* acquire;\n    const mapping = captureOAuthMapping(original);\n\n    yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => OAuthUnavailable.make({})));\n\n    return yield* make(target.tables, mapping);\n  });\n\nconst coordinate = <S, A, E, R, ES, RS>(\n  make: Effect.Effect<S, ES, RS>,\n  body: (services: S) => Effect.Effect<A, E, R>,\n) =>\n  Effect.gen(function* () {\n    const { client } = yield* acquire;\n\n    if (yield* hasCommitScope) return yield* OAuthUnavailable.make({});\n    yield* requireStandalone(() => OAuthUnavailable.make({}), client.transactionService);\n    const executor = yield* makeSqlCommitExecutor(() => OAuthUnavailable.make({}));\n\n    return yield* executor.coordinate(\n      Effect.flatMap(make.pipe(Effect.mapError(() => OAuthUnavailable.make({}))), body),\n    );\n  });\n\nexport const makeOAuthSignInServices = <N>(\n  mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthSignInPersistence: OAuthSignInPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthSignInServices(tables, value as unknown as OAuthNativeReadMapping),\n  );\n\nexport const coordinateOAuthSignIn = <N, A, E, R>(\n  options: { readonly mapping: OAuthSignInMapping<Table, Table, Table, Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthSignInPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthSignInServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthSignInPersistence, services.oauthSignInPersistence),\n  );\n\nexport const makeOAuthAccountsServices = <N>(\n  mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthAccountsPersistence: OAuthAccountsPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthAccountsServices(tables, value as unknown as OAuthNativeAccountsMapping),\n  );\n\nexport const coordinateOAuthAccounts = <N, A, E, R>(\n  options: { readonly mapping: OAuthAccountsMapping<Table, Table, Table, Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthAccountsPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthAccountsServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthAccountsPersistence, services.oauthAccountsPersistence),\n  );\n\nexport const makeOAuthRegistrationIntentServices = <N>(\n  mapping: OAuthRegistrationIntentMapping<Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthRegistrationIntents: OAuthRegistrationIntents[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthRegistrationIntentServices(\n      tables,\n      value as unknown as OAuthNativeRegistrationIntentMapping,\n    ),\n  );\n\nexport const coordinateOAuthRegistrationIntents = <N, A, E, R>(\n  options: { readonly mapping: OAuthRegistrationIntentMapping<Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthRegistrationIntents> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthRegistrationIntentServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthRegistrationIntents, services.oauthRegistrationIntents),\n  );\n\nexport const makeOAuthConnectedServices = <N>(\n  mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, N, Table>,\n): Effect.Effect<\n  { readonly oauthConnectedPersistence: OAuthConnectedPersistence[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthConnectedServices(tables, value as unknown as OAuthNativeConnectedMapping),\n  );\n\nexport const coordinateOAuthConnected = <N, A, E, R>(\n  options: { readonly mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, N, Table> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthConnectedPersistence> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthConnectedServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthConnectedPersistence, services.oauthConnectedPersistence),\n  );\n\nexport const makeOAuthConnectedRevocationServices = <N>(\n  mapping: OAuthConnectedRevocationMapping<Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly oauthConnectedRevocations: OAuthConnectedRevocations[\"Service\"] },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthRevocationServices(tables, value as unknown as OAuthNativeRevocationMapping),\n  );\n\nexport const coordinateOAuthConnectedRevocations = <N, A, E, R>(\n  options: { readonly mapping: OAuthConnectedRevocationMapping<Table, Table, Table, N> },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, OAuthConnectedRevocations> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthConnectedRevocationServices(options.mapping), (services) =>\n    Effect.provideService(body, OAuthConnectedRevocations, services.oauthConnectedRevocations),\n  );\n\nexport const makeOAuthRegistrationServices = <Registration, N>(\n  mapping: OAuthRegistrationMapping<Registration, Table, Table, Table, Table, Table, N>,\n): Effect.Effect<\n  { readonly registrationAuthority: OAuthRegistrationAuthority<Registration> },\n  OAuthUnavailable | PersistenceConfigurationError,\n  Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  using(mapping, (tables, value) =>\n    makeNativeOAuthRegistrationServices(\n      tables,\n      value as unknown as OAuthNativeRegistrationMapping<Registration>,\n    ),\n  );\n\nexport const coordinateOAuthRegistration = <Id, Registration, N, A, E, R>(\n  options: {\n    readonly mapping: OAuthRegistrationMapping<\n      NoInfer<Registration>,\n      Table,\n      Table,\n      Table,\n      Table,\n      Table,\n      N\n    >;\n    readonly target: Context.Key<Id, OAuthRegistrationAuthority<Registration>>;\n  },\n  body: Effect.Effect<A, E, R>,\n): Effect.Effect<\n  A,\n  E | OAuthUnavailable | PersistenceConfigurationError,\n  Exclude<R, Id> | Crypto.Crypto | LifecycleHooks | SqlClient.SqlClient\n> =>\n  coordinate(makeOAuthRegistrationServices(options.mapping), (services) =>\n    Effect.provideService(body, options.target, services.registrationAuthority),\n  );\n\nexport const oauthConnectedOwnershipReferences = <N>(\n  mapping: OAuthConnectedMapping<Table, Table, Table, Table, Table, N, Table>,\n) => ({\n  connectedReference: (input: { readonly identityKey: string; readonly subjectId: N }) => {\n    const g = mapping.grant;\n    const grant = sql`exists(select 1 from ${g.table} where ${g.table.columns[g.identityKey]} = ${input.identityKey} and ${g.table.columns[g.subjectId]} = ${input.subjectId})`;\n\n    if (mapping.revocation.mode === \"unsupported\") return grant;\n    const j = mapping.revocation.job;\n\n    return sql`(${grant}) or exists(select 1 from ${j.table} where ${j.table.columns[j.identityKey]} = ${input.identityKey} and ${j.table.columns[j.subjectId]} = ${input.subjectId})`;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,MAAa,SAAS,eACpB,IAAI,MAAM,WAAW,MAAM,WAAW,SAAS,WAAW,QAAQ,WAAW,MAAM;AAErF,MAAa,QAAQ;CACnB,eAAe,OAAO,WAAW,OAAO,GAAG;CAC3C,eAAe,OAAO,kBAAkB,OAAO,GAAG;CAClD,iBAAiB,IAAI,eAAe,WAClC,OAAO,gBAAgB;EACrB,UAAU,MAAM;EAChB,cAAc,MAAM;CACtB,CAAC,CACH;CACA,WAAW,eAA8B;CACzC,aAAa,eAA8B;AAC7C;AAEA,MAAM,UAAU,OAAO,IAAI,aAAa;CACtC,MAAM,SAAS,OAAO,UAAU;CAEhC,IACE,CAAC,OAAO,gBAAgB;EAAE,UAAU;EAAM,cAAc;EAAM,cAAc;CAAM,CAAC,KACnF,UAAU,YAAY,QAAQ,0BAA0B,GAExD,OAAO,OAAO,8BAA8B,KAAK,EAC/C,QAAQ,gFACV,CAAC;CAEH,OAAO;EAAE;EAAQ,QAAQ,oBAAoB,MAAM;CAAE;AACvD,CAAC;AAED,MAAM,SACJ,UACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAO;CACtB,MAAM,UAAU,oBAAoB,QAAQ;CAE5C,OAAO,mBAAmB,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC;CAExF,OAAO,OAAO,KAAK,OAAO,QAAQ,OAAO;AAC3C,CAAC;AAEH,MAAM,cACJ,MACA,SAEA,OAAO,IAAI,aAAa;CACtB,MAAM,EAAE,WAAW,OAAO;CAE1B,IAAI,OAAO,gBAAgB,OAAO,OAAO,iBAAiB,KAAK,CAAC,CAAC;CACjE,OAAO,wBAAwB,iBAAiB,KAAK,CAAC,CAAC,GAAG,OAAO,kBAAkB;CAGnF,OAAO,QAAO,OAFU,4BAA4B,iBAAiB,KAAK,CAAC,CAAC,CAAC,EAAA,CAEtD,WACrB,OAAO,QAAQ,KAAK,KAAK,OAAO,eAAe,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAClF;AACF,CAAC;AAEH,MAAa,2BACX,YAMA,MAAM,UAAU,QAAQ,UACtB,8BAA8B,QAAQ,KAA0C,CAClF;AAEF,MAAa,yBACX,SACA,SAMA,WAAW,wBAAwB,QAAQ,OAAO,IAAI,aACpD,OAAO,eAAe,MAAM,wBAAwB,SAAS,sBAAsB,CACrF;AAEF,MAAa,6BACX,YAMA,MAAM,UAAU,QAAQ,UACtB,gCAAgC,QAAQ,KAA8C,CACxF;AAEF,MAAa,2BACX,SACA,SAMA,WAAW,0BAA0B,QAAQ,OAAO,IAAI,aACtD,OAAO,eAAe,MAAM,0BAA0B,SAAS,wBAAwB,CACzF;AAEF,MAAa,uCACX,YAMA,MAAM,UAAU,QAAQ,UACtB,0CACE,QACA,KACF,CACF;AAEF,MAAa,sCACX,SACA,SAMA,WAAW,oCAAoC,QAAQ,OAAO,IAAI,aAChE,OAAO,eAAe,MAAM,0BAA0B,SAAS,wBAAwB,CACzF;AAEF,MAAa,8BACX,YAMA,MAAM,UAAU,QAAQ,UACtB,iCAAiC,QAAQ,KAA+C,CAC1F;AAEF,MAAa,4BACX,SACA,SAMA,WAAW,2BAA2B,QAAQ,OAAO,IAAI,aACvD,OAAO,eAAe,MAAM,2BAA2B,SAAS,yBAAyB,CAC3F;AAEF,MAAa,wCACX,YAMA,MAAM,UAAU,QAAQ,UACtB,kCAAkC,QAAQ,KAAgD,CAC5F;AAEF,MAAa,uCACX,SACA,SAMA,WAAW,qCAAqC,QAAQ,OAAO,IAAI,aACjE,OAAO,eAAe,MAAM,2BAA2B,SAAS,yBAAyB,CAC3F;AAEF,MAAa,iCACX,YAMA,MAAM,UAAU,QAAQ,UACtB,oCACE,QACA,KACF,CACF;AAEF,MAAa,+BACX,SAYA,SAMA,WAAW,8BAA8B,QAAQ,OAAO,IAAI,aAC1D,OAAO,eAAe,MAAM,QAAQ,QAAQ,SAAS,qBAAqB,CAC5E;AAEF,MAAa,qCACX,aACI,EACJ,qBAAqB,UAAmE;CACtF,MAAM,IAAI,QAAQ;CAClB,MAAM,QAAQ,GAAG,wBAAwB,EAAE,MAAM,SAAS,EAAE,MAAM,QAAQ,EAAE,aAAa,KAAK,MAAM,YAAY,OAAO,EAAE,MAAM,QAAQ,EAAE,WAAW,KAAK,MAAM,UAAU;CAEzK,IAAI,QAAQ,WAAW,SAAS,eAAe,OAAO;CACtD,MAAM,IAAI,QAAQ,WAAW;CAE7B,OAAO,GAAG,IAAI,MAAM,4BAA4B,EAAE,MAAM,SAAS,EAAE,MAAM,QAAQ,EAAE,aAAa,KAAK,MAAM,YAAY,OAAO,EAAE,MAAM,QAAQ,EAAE,WAAW,KAAK,MAAM,UAAU;AAClL,EACF"}

package/dist/index.d.mts

@@ -1,9 +1,9 @@
 import { PersistenceMappingError } from "./internal/mapping-error.mjs";
 import { OAuthProxyPersistence } from "./internal/oauth-proxy.mjs";
-import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
+import { StorageTable } from "./internal/storage-tables.mjs";
 import { PersistenceConfigurationError } from "./internal/configuration.mjs";
 import { OAuthPersistence_d_exports } from "./OAuthPersistence.mjs";
 import { AuthPersistence } from "./internal/sql-persistence.mjs";
 import { OAuthServerPersistence } from "./internal/oauth-server.mjs";
 import { BrowserLoginPersistence } from "./internal/browser-login.mjs";
-export { AuthPersistence, BrowserLoginPersistence, OAuthPersistence_d_exports as OAuthPersistence, OAuthProxyPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };
+export { AuthPersistence, BrowserLoginPersistence, OAuthPersistence_d_exports as OAuthPersistence, OAuthProxyPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageTable };

package/dist/index.mjs

@@ -1,9 +1,9 @@
 import { PersistenceConfigurationError } from "./internal/configuration.mjs";
 import { PersistenceMappingError } from "./internal/mapping-error.mjs";
-import { StorageColumn, StorageTable } from "./internal/storage-tables.mjs";
+import { StorageTable } from "./internal/storage-tables.mjs";
 import { AuthPersistence } from "./internal/sql-persistence.mjs";
 import { OAuthServerPersistence } from "./internal/oauth-server.mjs";
 import { OAuthProxyPersistence } from "./internal/oauth-proxy.mjs";
 import { BrowserLoginPersistence } from "./internal/browser-login.mjs";
 import { OAuthPersistence_exports } from "./OAuthPersistence.mjs";
-export { AuthPersistence, BrowserLoginPersistence, OAuthPersistence_exports as OAuthPersistence, OAuthProxyPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageColumn, StorageTable };
+export { AuthPersistence, BrowserLoginPersistence, OAuthPersistence_exports as OAuthPersistence, OAuthProxyPersistence, OAuthServerPersistence, PersistenceConfigurationError, PersistenceMappingError, StorageTable };

package/dist/internal/browser-login.d.mts

@@ -4,7 +4,7 @@ import { Persistence, Unavailable } from "@yielded/auth/BrowserLogin";
 //#region src/internal/browser-login.d.ts
 export declare const BrowserLoginPersistence: {
   migration: string;
-  layer: Layer.Layer<Persistence, Unavailable, SqlClient.SqlClient>;
+  layer: Layer.Layer<Persistence, Unavailable, import("@yielded/auth/Hooks").LifecycleHooks | SqlClient.SqlClient>;
 };
 //#endregion
 //# sourceMappingURL=browser-login.d.mts.map

package/dist/internal/browser-login.mjs

@@ -1,4 +1,8 @@
-import { requireStandalone } from "./standalone.mjs";
+import { Table } from "./sql-table.mjs";
+import { makeNativeSqlTables } from "./native-sql-table.mjs";
+import { exactSqlText } from "./sql-change.mjs";
+import { makeSqlCommitExecutor } from "./sql-commit.mjs";
+import { cleanupSqlRows } from "./sql-cleanup.mjs";
 import { Effect, Layer, Schema } from "effect";
 import { SqlClient } from "effect/sql";
 import { Persistence, Record, Unavailable } from "@yielded/auth/BrowserLogin";
@@ -24,15 +28,33 @@ const BrowserLoginPersistence = {
 			pg: () => true,
 			orElse: () => false
 		})) return yield* Unavailable.make({});
-		const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);
-		const failure = (effect) => effect.pipe(Effect.mapError(() => Unavailable.make({})));
+		const executor = yield* makeSqlCommitExecutor(() => Unavailable.make({}));
+		const table = makeNativeSqlTables(sql)(new Table("yielded_browser_login", {
+			namespace: {
+				name: "namespace",
+				type: "text"
+			},
+			attemptId: {
+				name: "attempt_id",
+				type: "text"
+			},
+			expiresAt: {
+				name: "expires_at_millis",
+				type: "integer"
+			}
+		}, [["namespace", "attemptId"]]));
 		const clock = sql.onDialectOrElse({
 			sqlite: () => sql.literal("CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)"),
 			orElse: () => sql.literal("CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)")
 		});
 		return Persistence.of({
+			cleanup: ({ namespace, limit }) => executor.run(cleanupSqlRows([{
+				table,
+				keys: ["namespace", "attemptId"],
+				due: sql`${exactSqlText(sql, table.column("namespace"), table.value("namespace", namespace))} and ${table.column("expiresAt")} <= ${clock}`,
+				order: [table.column("expiresAt"), table.column("attemptId")]
+			}], limit), "statement"),
 			get: Effect.fnUntraced(function* (namespace, id) {
-				yield* standalone;
 				const rows = yield* sql`SELECT payload, version FROM yielded_browser_login WHERE namespace = ${namespace} AND attempt_id = ${id}`;
 				if (rows.length === 0) return void 0;
 				if (rows.length !== 1) return yield* Unavailable.make({});
@@ -40,24 +62,22 @@ const BrowserLoginPersistence = {
 				const record = yield* Schema.decodeEffect(codec)(row.payload);
 				if (record.version !== row.version) return yield* Unavailable.make({});
 				return record;
-			}, failure),
+			}, executor.read),
 			insert: Effect.fnUntraced(function* (namespace, id, record) {
-				yield* standalone;
 				const payload = yield* Schema.encodeEffect(codec)(record);
 				return (yield* sql`INSERT INTO yielded_browser_login (namespace, attempt_id, version, expires_at_millis, payload)
         SELECT ${namespace}, ${id}, ${record.version}, ${record.expiresAtMillis}, ${payload}
         WHERE ${record.expiresAtMillis} > ${clock}
         ON CONFLICT (namespace, attempt_id) DO NOTHING RETURNING version`).length === 1;
-			}, failure),
+			}, (effect) => executor.run(effect, "statement")),
 			compareAndSet: Effect.fnUntraced(function* (namespace, id, version, record) {
-				yield* standalone;
 				if (version === record.version) return yield* Unavailable.make({});
 				const payload = yield* Schema.encodeEffect(codec)(record);
 				return (yield* sql`UPDATE yielded_browser_login SET version = ${record.version}, payload = ${payload}
         WHERE namespace = ${namespace} AND attempt_id = ${id} AND version = ${version}
         AND expires_at_millis = ${record.expiresAtMillis} AND expires_at_millis > ${clock}
         RETURNING version`).length === 1;
-			}, failure)
+			}, (effect) => executor.run(effect, "statement"))
 		});
 	}))
 };

package/dist/internal/browser-login.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"browser-login.mjs","names":[],"sources":["../../src/internal/browser-login.ts"],"sourcesContent":["import { Persistence, Record, Unavailable } from \"@yielded/auth/BrowserLogin\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { requireStandalone } from \"./standalone\";\n\nconst codec = Schema.fromJsonString(Record);\nconst Row = Schema.Struct({ payload: Schema.String, version: Schema.String });\n\n/** SQLite/D1 and PostgreSQL; apply through application migrations. Terminal\n * attempts are retained until expiry. Contains private provenance, never bearers.\n */\nconst migration = `CREATE TABLE yielded_browser_login (\n  namespace TEXT NOT NULL,\n  attempt_id TEXT NOT NULL,\n  version TEXT NOT NULL,\n  expires_at_millis BIGINT NOT NULL,\n  payload TEXT NOT NULL,\n  PRIMARY KEY (namespace, attempt_id)\n)`;\n\nconst layer = Layer.effect(\n  Persistence,\n  Effect.gen(function* () {\n    const sql = yield* SqlClient.SqlClient;\n\n    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))\n      return yield* Unavailable.make({});\n    const standalone = requireStandalone(() => Unavailable.make({}), sql.transactionService);\n\n    const failure = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n      effect.pipe(Effect.mapError(() => Unavailable.make({})));\n\n    const clock = sql.onDialectOrElse({\n      sqlite: () => sql.literal(\"CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)\"),\n      orElse: () => sql.literal(\"CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)\"),\n    });\n\n    return Persistence.of({\n      get: Effect.fnUntraced(function* (namespace, id) {\n        yield* standalone;\n\n        const rows =\n          yield* sql`SELECT payload, version FROM yielded_browser_login WHERE namespace = ${namespace} AND attempt_id = ${id}`;\n\n        if (rows.length === 0) return undefined;\n        if (rows.length !== 1) return yield* Unavailable.make({});\n        const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);\n        const record = yield* Schema.decodeEffect(codec)(row.payload);\n\n        if (record.version !== row.version) return yield* Unavailable.make({});\n\n        return record;\n      }, failure),\n      insert: Effect.fnUntraced(function* (namespace, id, record) {\n        yield* standalone;\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`INSERT INTO yielded_browser_login (namespace, attempt_id, version, expires_at_millis, payload)\n        SELECT ${namespace}, ${id}, ${record.version}, ${record.expiresAtMillis}, ${payload}\n        WHERE ${record.expiresAtMillis} > ${clock}\n        ON CONFLICT (namespace, attempt_id) DO NOTHING RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n      compareAndSet: Effect.fnUntraced(function* (namespace, id, version, record) {\n        yield* standalone;\n        if (version === record.version) return yield* Unavailable.make({});\n        const payload = yield* Schema.encodeEffect(codec)(record);\n\n        const rows =\n          yield* sql`UPDATE yielded_browser_login SET version = ${record.version}, payload = ${payload}\n        WHERE namespace = ${namespace} AND attempt_id = ${id} AND version = ${version}\n        AND expires_at_millis = ${record.expiresAtMillis} AND expires_at_millis > ${clock}\n        RETURNING version`;\n\n        return rows.length === 1;\n      }, failure),\n    });\n  }),\n);\n\nexport const BrowserLoginPersistence = { migration, layer };\n"],"mappings":";;;;;AAMA,MAAM,QAAQ,OAAO,eAAe,MAAM;AAC1C,MAAM,MAAM,OAAO,OAAO;CAAE,SAAS,OAAO;CAAQ,SAAS,OAAO;AAAO,CAAC;AA4E5E,MAAa,0BAA0B;CAAE;;;;;;;;CAAW,OA9DtC,MAAM,OAClB,aACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU;EAE7B,IAAI,CAAC,IAAI,gBAAgB;GAAE,cAAc;GAAM,UAAU;GAAM,cAAc;EAAM,CAAC,GAClF,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EACnC,MAAM,aAAa,wBAAwB,YAAY,KAAK,CAAC,CAAC,GAAG,IAAI,kBAAkB;EAEvF,MAAM,WAAoB,WACxB,OAAO,KAAK,OAAO,eAAe,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC;EAEzD,MAAM,QAAQ,IAAI,gBAAgB;GAChC,cAAc,IAAI,QAAQ,4DAA4D;GACtF,cAAc,IAAI,QAAQ,8DAA8D;EAC1F,CAAC;EAED,OAAO,YAAY,GAAG;GACpB,KAAK,OAAO,WAAW,WAAW,WAAW,IAAI;IAC/C,OAAO;IAEP,MAAM,OACJ,OAAO,GAAG,wEAAwE,UAAU,oBAAoB;IAElH,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,OAAO,OAAO,oBAAoB,GAAG,CAAC,CAAC,KAAK,EAAE;IAC1D,MAAM,SAAS,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO;IAE5D,IAAI,OAAO,YAAY,IAAI,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IAErE,OAAO;GACT,GAAG,OAAO;GACV,QAAQ,OAAO,WAAW,WAAW,WAAW,IAAI,QAAQ;IAC1D,OAAO;IACP,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAQxD,QAAO,OALE,GAAG;iBACH,UAAU,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAI,OAAO,gBAAgB,IAAI,QAAQ;gBAC5E,OAAO,gBAAgB,KAAK,MAAM;0EAG/B,CAAC,WAAW;GACzB,GAAG,OAAO;GACV,eAAe,OAAO,WAAW,WAAW,WAAW,IAAI,SAAS,QAAQ;IAC1E,OAAO;IACP,IAAI,YAAY,OAAO,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACjE,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAQxD,QAAO,OALE,GAAG,8CAA8C,OAAO,QAAQ,cAAc,QAAQ;4BAC3E,UAAU,oBAAoB,GAAG,iBAAiB,QAAQ;kCACpD,OAAO,gBAAgB,2BAA2B,MAAM;2BAGvE,CAAC,WAAW;GACzB,GAAG,OAAO;EACZ,CAAC;CACH,CAAC,CAGiD;AAAM"}
+{"version":3,"file":"browser-login.mjs","names":[],"sources":["../../src/internal/browser-login.ts"],"sourcesContent":["import { Persistence, Record, Unavailable } from \"@yielded/auth/BrowserLogin\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { SqlClient } from \"effect/sql\";\n\nimport { makeNativeSqlTables } from \"./native-sql-table\";\nimport { exactSqlText } from \"./sql-change\";\nimport { cleanupSqlRows } from \"./sql-cleanup\";\nimport { makeSqlCommitExecutor } from \"./sql-commit\";\nimport { Table } from \"./sql-table\";\n\nconst codec = Schema.fromJsonString(Record);\nconst Row = Schema.Struct({ payload: Schema.String, version: Schema.String });\n\n/** SQLite/D1 and PostgreSQL; apply through application migrations. Terminal\n * attempts are retained until expiry. Contains private provenance, never bearers.\n */\nconst migration = `CREATE TABLE yielded_browser_login (\n  namespace TEXT NOT NULL,\n  attempt_id TEXT NOT NULL,\n  version TEXT NOT NULL,\n  expires_at_millis BIGINT NOT NULL,\n  payload TEXT NOT NULL,\n  PRIMARY KEY (namespace, attempt_id)\n)`;\n\nconst layer = Layer.effect(\n  Persistence,\n  Effect.gen(function* () {\n    const sql = yield* SqlClient.SqlClient;\n\n    if (!sql.onDialectOrElse({ sqlite: () => true, pg: () => true, orElse: () => false }))\n      return yield* Unavailable.make({});\n    const executor = yield* makeSqlCommitExecutor(() => Unavailable.make({}));\n\n    const table = makeNativeSqlTables(sql)(\n      new Table(\n        \"yielded_browser_login\",\n        {\n          namespace: { name: \"namespace\", type: \"text\" },\n          attemptId: { name: \"attempt_id\", type: \"text\" },\n          expiresAt: { name: \"expires_at_millis\", type: \"integer\" },\n        },\n        [[\"namespace\", \"attemptId\"]],\n      ),\n    );\n\n    const clock = sql.onDialectOrElse({\n      sqlite: () => sql.literal(\"CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)\"),\n      orElse: () => sql.literal(\"CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)\"),\n    });\n\n    return Persistence.of({\n      cleanup: ({ namespace, limit }) =>\n        executor.run(\n          cleanupSqlRows(\n            [\n              {\n                table,\n                keys: [\"namespace\", \"attemptId\"],\n                due: sql`${exactSqlText(sql, table.column(\"namespace\"), table.value(\"namespace\", namespace))} and ${table.column(\"expiresAt\")} <= ${clock}`,\n                order: [table.column(\"expiresAt\"), table.column(\"attemptId\")],\n              },\n            ],\n            limit,\n          ),\n          \"statement\",\n        ),\n      get: Effect.fnUntraced(function* (namespace, id) {\n        const rows =\n          yield* sql`SELECT payload, version FROM yielded_browser_login WHERE namespace = ${namespace} AND attempt_id = ${id}`;\n\n        if (rows.length === 0) return undefined;\n        if (rows.length !== 1) return yield* Unavailable.make({});\n        const row = yield* Schema.decodeUnknownEffect(Row)(rows[0]);\n        const record = yield* Schema.decodeEffect(codec)(row.payload);\n\n        if (record.version !== row.version) return yield* Unavailable.make({});\n\n        return record;\n      }, executor.read),\n      insert: Effect.fnUntraced(\n        function* (namespace, id, record) {\n          const payload = yield* Schema.encodeEffect(codec)(record);\n\n          const rows =\n            yield* sql`INSERT INTO yielded_browser_login (namespace, attempt_id, version, expires_at_millis, payload)\n        SELECT ${namespace}, ${id}, ${record.version}, ${record.expiresAtMillis}, ${payload}\n        WHERE ${record.expiresAtMillis} > ${clock}\n        ON CONFLICT (namespace, attempt_id) DO NOTHING RETURNING version`;\n\n          return rows.length === 1;\n        },\n        (effect) => executor.run(effect, \"statement\"),\n      ),\n      compareAndSet: Effect.fnUntraced(\n        function* (namespace, id, version, record) {\n          if (version === record.version) return yield* Unavailable.make({});\n          const payload = yield* Schema.encodeEffect(codec)(record);\n\n          const rows =\n            yield* sql`UPDATE yielded_browser_login SET version = ${record.version}, payload = ${payload}\n        WHERE namespace = ${namespace} AND attempt_id = ${id} AND version = ${version}\n        AND expires_at_millis = ${record.expiresAtMillis} AND expires_at_millis > ${clock}\n        RETURNING version`;\n\n          return rows.length === 1;\n        },\n        (effect) => executor.run(effect, \"statement\"),\n      ),\n    });\n  }),\n);\n\nexport const BrowserLoginPersistence = { migration, layer };\n"],"mappings":";;;;;;;;;AAUA,MAAM,QAAQ,OAAO,eAAe,MAAM;AAC1C,MAAM,MAAM,OAAO,OAAO;CAAE,SAAS,OAAO;CAAQ,SAAS,OAAO;AAAO,CAAC;AAsG5E,MAAa,0BAA0B;CAAE;;;;;;;;CAAW,OAxFtC,MAAM,OAClB,aACA,OAAO,IAAI,aAAa;EACtB,MAAM,MAAM,OAAO,UAAU;EAE7B,IAAI,CAAC,IAAI,gBAAgB;GAAE,cAAc;GAAM,UAAU;GAAM,cAAc;EAAM,CAAC,GAClF,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;EACnC,MAAM,WAAW,OAAO,4BAA4B,YAAY,KAAK,CAAC,CAAC,CAAC;EAExE,MAAM,QAAQ,oBAAoB,GAAG,CAAC,CACpC,IAAI,MACF,yBACA;GACE,WAAW;IAAE,MAAM;IAAa,MAAM;GAAO;GAC7C,WAAW;IAAE,MAAM;IAAc,MAAM;GAAO;GAC9C,WAAW;IAAE,MAAM;IAAqB,MAAM;GAAU;EAC1D,GACA,CAAC,CAAC,aAAa,WAAW,CAAC,CAC7B,CACF;EAEA,MAAM,QAAQ,IAAI,gBAAgB;GAChC,cAAc,IAAI,QAAQ,4DAA4D;GACtF,cAAc,IAAI,QAAQ,8DAA8D;EAC1F,CAAC;EAED,OAAO,YAAY,GAAG;GACpB,UAAU,EAAE,WAAW,YACrB,SAAS,IACP,eACE,CACE;IACE;IACA,MAAM,CAAC,aAAa,WAAW;IAC/B,KAAK,GAAG,GAAG,aAAa,KAAK,MAAM,OAAO,WAAW,GAAG,MAAM,MAAM,aAAa,SAAS,CAAC,EAAE,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM;IACpI,OAAO,CAAC,MAAM,OAAO,WAAW,GAAG,MAAM,OAAO,WAAW,CAAC;GAC9D,CACF,GACA,KACF,GACA,WACF;GACF,KAAK,OAAO,WAAW,WAAW,WAAW,IAAI;IAC/C,MAAM,OACJ,OAAO,GAAG,wEAAwE,UAAU,oBAAoB;IAElH,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;IAC9B,IAAI,KAAK,WAAW,GAAG,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,OAAO,OAAO,oBAAoB,GAAG,CAAC,CAAC,KAAK,EAAE;IAC1D,MAAM,SAAS,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO;IAE5D,IAAI,OAAO,YAAY,IAAI,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IAErE,OAAO;GACT,GAAG,SAAS,IAAI;GAChB,QAAQ,OAAO,WACb,WAAW,WAAW,IAAI,QAAQ;IAChC,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAQxD,QAAO,OALE,GAAG;iBACL,UAAU,IAAI,GAAG,IAAI,OAAO,QAAQ,IAAI,OAAO,gBAAgB,IAAI,QAAQ;gBAC5E,OAAO,gBAAgB,KAAK,MAAM;0EAG7B,CAAC,WAAW;GACzB,IACC,WAAW,SAAS,IAAI,QAAQ,WAAW,CAC9C;GACA,eAAe,OAAO,WACpB,WAAW,WAAW,IAAI,SAAS,QAAQ;IACzC,IAAI,YAAY,OAAO,SAAS,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC;IACjE,MAAM,UAAU,OAAO,OAAO,aAAa,KAAK,CAAC,CAAC,MAAM;IAQxD,QAAO,OALE,GAAG,8CAA8C,OAAO,QAAQ,cAAc,QAAQ;4BAC7E,UAAU,oBAAoB,GAAG,iBAAiB,QAAQ;kCACpD,OAAO,gBAAgB,2BAA2B,MAAM;2BAGrE,CAAC,WAAW;GACzB,IACC,WAAW,SAAS,IAAI,QAAQ,WAAW,CAC9C;EACF,CAAC;CACH,CAAC,CAGiD;AAAM"}

package/dist/internal/configuration.d.mts

@@ -2,14 +2,14 @@ import { PersistenceMappingError } from "./mapping-error.mjs";
 import { StorageRole } from "./storage-tables.mjs";
 import { Context, Crypto, Effect, Layer, Schema } from "effect";
 import { SqlClient } from "effect/sql";
-import { PasskeyActionChallenge, PasskeyConfig, PasskeyConfigurationError, PasskeyCredentials, PasskeyEnrollmentContext, PasskeyManagementPersistence, PasskeyManagementPolicy, PasskeyMethodPolicy, PasskeyPersistence } from "@yielded/auth/Passkey";
-import { SubjectId } from "@yielded/auth/Schema";
-import { AuthenticationAuthority, AuthenticationRequirement, make } from "@yielded/auth/Sessions";
-import { ProofPersistence } from "@yielded/auth/Proofs";
 import { EmailAction, EmailAddressPersistence } from "@yielded/auth/Email";
+import { PasskeyActionChallenge, PasskeyConfig, PasskeyConfigurationError, PasskeyCredentials, PasskeyManagementPersistence, PasskeyManagementPolicy, PasskeyMethodPolicy, PasskeyPersistence } from "@yielded/auth/Passkey";
 import { PasswordAction, PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
-import { PhoneAdmission, PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import { PhoneSignInTargets } from "@yielded/auth/PhoneOtp";
+import { ProofPersistence } from "@yielded/auth/Proofs";
+import { AuthenticationAuthority, AuthenticationRequirement, make } from "@yielded/auth/Sessions";
 import { LoginIdentifier } from "@yielded/auth/Identity";
+import { SubjectId } from "@yielded/auth/Schema";
 //#region src/internal/configuration.d.ts
 declare const PersistenceConfigurationError_base: Schema.Class<PersistenceConfigurationError, Schema.TaggedStruct<"PersistenceConfigurationError", {
   readonly reason: Schema.String;
@@ -86,6 +86,7 @@ export type Provisioning<A extends {
     management: true;
   };
 } ? K : never]: (input: {
+  readonly requestId: string;
   readonly identifier: LoginIdentifier;
   readonly registration: Registration<A["strategies"][K]>;
 }) => Effect.Effect<SubjectId, PasswordUnavailable>; };
@@ -93,12 +94,12 @@ export type ProvisioningRequirement<A extends {
   readonly namespace: string;
   readonly strategies: Readonly<Record<string, Strategy>>;
 }> = ManagedPassword<A> extends never ? never : ProvisioningId<A["namespace"]>;
-type ProofRoles = "proofRequests" | "proofSeries" | "proofGenerations" | "proofContinuations" | "proofScopes" | "proofAbuse" | "proofFailures" | "proofCommands";
+type ProofRoles = "proofs";
 type UsesProofs<A extends {
   readonly strategies: Readonly<Record<string, Strategy>>;
 }> = Enabled<A, "phone"> | Enabled<A, "email"> | ManagedPassword<A>;
-export type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = AuthenticationAuthority | KeyId<A["sessions"]["StatefulSessionPersistence"]> | KeyId<A["sessions"]["SessionRepository"]> | (Enabled<A, "password"> extends never ? never : PasswordPersistence) | KeyId<RegistrationKey<ManagedPassword<A>>> | (Enabled<A, "passkey"> extends never ? never : PasskeyPersistence | PasskeyCredentials) | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence | PasskeyEnrollmentContext) | (Enabled<A, "email"> extends never ? never : EmailAddressPersistence) | (UsesProofs<A> extends never ? never : ProofPersistence) | (Enabled<A, "phone"> extends never ? never : PhoneAdmission | PhoneSignInTargets);
-export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = "identifiers" | "credentials" | "sessions" | "sessionFlows" | (Enabled<A, "password"> extends never ? never : "passwords" | "passwordCommands") | (ManagedPassword<A> extends never ? never : "passwordRegistrations") | (Enabled<A, "phone"> extends never ? never : "phoneState") | (Enabled<A, "email"> extends never ? never : "emailCredentials" | "emailCommands") | (Enabled<A, "passkey"> extends never ? never : "passkeyCredentials" | "passkeyOwnership" | "passkeyHandles" | "passkeyModules" | "passkeyFlows" | "passkeyAdmissions" | "passkeyCharges") | (ManagedPasskey<A> extends never ? never : "passkeyCommands") | (UsesProofs<A> extends never ? never : ProofRoles);
+export type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = AuthenticationAuthority | KeyId<A["sessions"]["StatefulSessionPersistence"]> | KeyId<A["sessions"]["SessionRepository"]> | KeyId<A["sessions"]["PendingAuthentication"]> | KeyId<A["sessions"]["SessionStepUpPersistence"]> | KeyId<A["sessions"]["SessionCleanup"]> | (Enabled<A, "password"> extends never ? never : PasswordPersistence) | KeyId<RegistrationKey<ManagedPassword<A>>> | (Enabled<A, "passkey"> extends never ? never : PasskeyPersistence | PasskeyCredentials) | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence) | (Enabled<A, "email"> extends never ? never : EmailAddressPersistence) | (UsesProofs<A> extends never ? never : ProofPersistence) | (Enabled<A, "phone"> extends never ? never : PhoneSignInTargets);
+export type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> = "identifiers" | "credentials" | "sessions" | "pending" | (Enabled<A, "password"> extends never ? never : "passwords") | (Enabled<A, "email"> extends never ? never : "emailCredentials") | (Enabled<A, "passkey"> extends never ? never : "passkeyCredentials" | "passkeyFlows") | (UsesProofs<A> extends never ? never : ProofRoles);
 export interface SubjectOptions<T extends object, NativeId> {
   readonly table: T;
   readonly id: string;
@@ -152,6 +153,10 @@ export interface BoundPersistence<T extends object, R, C extends ClaimsCodec, Id
    * Do not perform external side effects or open an independent transaction here.
    */
   readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;
+  /** Capture dependencies at acquisition; validate SQL metadata and configure storage
+   * once on the first service operation. Initialization failures become that port's
+   * unavailable error. Failure or interruption remains cached until layer reacquisition.
+   */
   readonly layer: Layer.Layer<Ports<C, Id, A>, PersistenceConfigurationError, Crypto.Crypto | ConfigId<A["namespace"]> | ProvisioningRequirement<A> | PasskeyRequirement$1<A> | SqlClient.SqlClient | R>;
   readonly managed: <N, Instant = number>(options: {
     readonly subjects: SubjectOptions<T, N>;

package/dist/internal/configuration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyEnrollmentContext,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneAdmission, PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string | undefined;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles =\n  | \"proofRequests\"\n  | \"proofSeries\"\n  | \"proofGenerations\"\n  | \"proofContinuations\"\n  | \"proofScopes\"\n  | \"proofAbuse\"\n  | \"proofFailures\"\n  | \"proofCommands\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never\n      ? never\n      : PasskeyManagementPersistence | PasskeyEnrollmentContext)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneAdmission | PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"sessionFlows\"\n  | (Enabled<A, \"password\"> extends never ? never : \"passwords\" | \"passwordCommands\")\n  | (ManagedPassword<A> extends never ? never : \"passwordRegistrations\")\n  | (Enabled<A, \"phone\"> extends never ? never : \"phoneState\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\" | \"emailCommands\")\n  | (Enabled<A, \"passkey\"> extends never\n      ? never\n      :\n          | \"passkeyCredentials\"\n          | \"passkeyOwnership\"\n          | \"passkeyHandles\"\n          | \"passkeyModules\"\n          | \"passkeyFlows\"\n          | \"passkeyAdmissions\"\n          | \"passkeyCharges\")\n  | (ManagedPasskey<A> extends never ? never : \"passkeyCommands\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | Crypto.Crypto\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    /** Stable SQL identifier prefix; reuse the deployed prefix for existing tables. */\n    readonly prefix: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AAgCA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}
+{"version":3,"file":"configuration.mjs","names":[],"sources":["../../src/internal/configuration.ts"],"sourcesContent":["import type { EmailAction, EmailAddressPersistence } from \"@yielded/auth/Email\";\nimport type { LoginIdentifier } from \"@yielded/auth/Identity\";\nimport type {\n  PasskeyActionChallenge,\n  PasskeyConfig,\n  PasskeyCredentials,\n  PasskeyManagementPersistence,\n  PasskeyManagementPolicy,\n  PasskeyMethodPolicy,\n  PasskeyPersistence,\n  PasskeyConfigurationError,\n} from \"@yielded/auth/Passkey\";\nimport type {\n  PasswordAction,\n  PasswordPersistence,\n  PasswordUnavailable,\n} from \"@yielded/auth/Password\";\nimport type { PhoneSignInTargets } from \"@yielded/auth/PhoneOtp\";\nimport type { ProofPersistence } from \"@yielded/auth/Proofs\";\nimport type { SubjectId } from \"@yielded/auth/Schema\";\nimport type {\n  AuthenticationAuthority,\n  AuthenticationRequirement,\n  make as makeSessions,\n} from \"@yielded/auth/Sessions\";\nimport { type Context, type Crypto, type Effect, type Layer, Schema } from \"effect\";\nimport type { SqlClient } from \"effect/sql\";\n\nimport type { PersistenceMappingError } from \"./mapping-error\";\nimport type { StorageRole } from \"./storage-tables\";\n\nexport class PersistenceConfigurationError extends Schema.TaggedError<PersistenceConfigurationError>()(\n  \"PersistenceConfigurationError\",\n  { reason: Schema.String },\n) {}\n\nexport type ClaimsCodec = Schema.Codec<unknown, unknown, never, never>;\n\nexport interface PasskeyFeature {\n  readonly kind: \"passkey\";\n  readonly moduleId: string;\n  readonly policy: Effect.Effect<PasskeyMethodPolicy, PasskeyConfigurationError, PasskeyConfig>;\n  readonly management?: boolean;\n  readonly managementPolicy?: PasskeyManagementPolicy;\n}\n\nexport interface Strategy {\n  readonly strategy: object;\n  readonly persistence?:\n    | PasskeyFeature\n    | {\n        readonly kind: \"password\" | \"phone\" | \"email\";\n        readonly moduleId: string;\n        readonly lifecycle?: boolean;\n        readonly management?: boolean;\n        readonly addresses?: boolean;\n      };\n  readonly RegistrationAuthority?: Context.Key<unknown, unknown>;\n}\n\nexport interface Definition<C extends ClaimsCodec, Id extends string> {\n  readonly namespace: string;\n  readonly claims: C;\n  readonly sessionMode?: string | undefined;\n  readonly sessions: ReturnType<typeof makeSessions<C, Id>>;\n  readonly strategies: Readonly<Record<string, Strategy>>;\n}\n\ntype KeyId<T> = T extends Context.Key<infer Id, infer _Service> ? Id : never;\ntype Enabled<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n  Kind extends \"password\" | \"phone\" | \"email\" | \"passkey\",\n> = Extract<A[\"strategies\"][keyof A[\"strategies\"]], { persistence: { kind: Kind } }>;\n\ntype ManagedPassword<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"password\">, { persistence: { management: true } }>;\n\ntype ManagedPasskey<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  Extract<Enabled<A, \"passkey\">, { persistence: { management: true } }>;\n\nexport type PasskeyRequirement<\n  A extends { readonly strategies: Readonly<Record<string, Strategy>> },\n> = Enabled<A, \"passkey\"> extends never ? never : PasskeyConfig;\n\ntype RegistrationKey<S> = S extends { readonly RegistrationAuthority: infer K } ? K : never;\ntype Registration<S> =\n  RegistrationKey<S> extends Context.Key<infer _Id, infer Service>\n    ? Service extends { readonly register: (input: infer Input, ...args: never[]) => unknown }\n      ? Input extends { readonly registration: infer Value }\n        ? Value\n        : never\n      : never\n    : never;\n\nexport interface ProvisioningId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceProvisioning\";\n}\n\nexport type Provisioning<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> = {\n  readonly [\n    K in keyof A[\"strategies\"] as A[\"strategies\"][K] extends {\n      persistence: { kind: \"password\"; management: true };\n    }\n      ? K\n      : never\n  ]: (input: {\n    readonly requestId: string;\n    readonly identifier: LoginIdentifier;\n    readonly registration: Registration<A[\"strategies\"][K]>;\n  }) => Effect.Effect<SubjectId, PasswordUnavailable>;\n};\n\nexport type ProvisioningRequirement<\n  A extends { readonly namespace: string; readonly strategies: Readonly<Record<string, Strategy>> },\n> = ManagedPassword<A> extends never ? never : ProvisioningId<A[\"namespace\"]>;\n\ntype ProofRoles = \"proofs\";\n\ntype UsesProofs<A extends { readonly strategies: Readonly<Record<string, Strategy>> }> =\n  | Enabled<A, \"phone\">\n  | Enabled<A, \"email\">\n  | ManagedPassword<A>;\n\nexport type Ports<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | AuthenticationAuthority\n  | KeyId<A[\"sessions\"][\"StatefulSessionPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionRepository\"]>\n  | KeyId<A[\"sessions\"][\"PendingAuthentication\"]>\n  | KeyId<A[\"sessions\"][\"SessionStepUpPersistence\"]>\n  | KeyId<A[\"sessions\"][\"SessionCleanup\"]>\n  | (Enabled<A, \"password\"> extends never ? never : PasswordPersistence)\n  | KeyId<RegistrationKey<ManagedPassword<A>>>\n  | (Enabled<A, \"passkey\"> extends never ? never : PasskeyPersistence | PasskeyCredentials)\n  | (ManagedPasskey<A> extends never ? never : PasskeyManagementPersistence)\n  | (Enabled<A, \"email\"> extends never ? never : EmailAddressPersistence)\n  | (UsesProofs<A> extends never ? never : ProofPersistence)\n  | (Enabled<A, \"phone\"> extends never ? never : PhoneSignInTargets);\n\nexport type Roles<C extends ClaimsCodec, Id extends string, A extends Definition<C, Id>> =\n  | \"identifiers\"\n  | \"credentials\"\n  | \"sessions\"\n  | \"pending\"\n  | (Enabled<A, \"password\"> extends never ? never : \"passwords\")\n  | (Enabled<A, \"email\"> extends never ? never : \"emailCredentials\")\n  | (Enabled<A, \"passkey\"> extends never ? never : \"passkeyCredentials\" | \"passkeyFlows\")\n  | (UsesProofs<A> extends never ? never : ProofRoles);\n\nexport interface SubjectOptions<T extends object, NativeId> {\n  readonly table: T;\n  readonly id: string;\n  readonly status: string;\n  readonly activeValue: unknown;\n  readonly securityRevision: string;\n  readonly idCodec: Schema.Codec<SubjectId, NativeId>;\n  readonly requirements: (\n    row: Readonly<Record<string, unknown>>,\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n  /** Defaults to sign-in requirements. Recovery can have a distinct application policy. */\n  readonly actionRequirements?: (\n    row: Readonly<Record<string, unknown>>,\n    action: PasswordAction | EmailAction | PasskeyActionChallenge[\"action\"],\n  ) => Effect.Effect<AuthenticationRequirement, PersistenceMappingError>;\n}\n\n/** Codecs at the application-owned subject and timestamp boundary. */\nexport interface SubjectMapping {\n  readonly table: object;\n  readonly id: string;\n  readonly status: string;\n  readonly securityRevision: string;\n  readonly activeValue: unknown;\n  readonly requirements: SubjectOptions<object, unknown>[\"requirements\"];\n  readonly actionRequirements: NonNullable<SubjectOptions<object, unknown>[\"actionRequirements\"]>;\n  readonly toSubject: (value: unknown) => Effect.Effect<SubjectId, PersistenceMappingError>;\n  readonly toNative: (value: SubjectId) => Effect.Effect<unknown, PersistenceMappingError>;\n  readonly toSubjectSync: (value: unknown) => SubjectId;\n  readonly toNativeSync: (value: SubjectId) => unknown;\n}\n\nexport interface MappingInput {\n  readonly tables: Partial<Record<StorageRole, object>>;\n  readonly subjects: SubjectMapping;\n  readonly encodeInstant: (millis: number) => unknown;\n  readonly decodeInstant: (value: unknown) => Effect.Effect<number, PersistenceMappingError>;\n  readonly decodeInstantSync: (value: unknown) => number;\n}\n\nexport interface StorageLayout<\n  T extends object,\n  Role extends StorageRole = StorageRole,\n> extends MappingInput {\n  readonly namespace: string;\n  readonly schema: Readonly<Record<Role, T>>;\n}\n\nexport interface ConfigId<Id extends string> {\n  readonly authNamespace: Id;\n  readonly service: \"PersistenceConfig\";\n}\n\nexport interface TimestampOptions<Instant> {\n  readonly type: \"text\" | \"integer\";\n  readonly codec: Schema.Codec<number, Instant>;\n}\n\nexport interface BoundPersistence<\n  T extends object,\n  R,\n  C extends ClaimsCodec,\n  Id extends string,\n  A extends Definition<C, Id>,\n> {\n  readonly Config: Context.Service<ConfigId<A[\"namespace\"]>, StorageLayout<T, Roles<C, Id, A>>> & {\n    readonly layer: (\n      value: StorageLayout<T, Roles<C, Id, A>>,\n    ) => Layer.Layer<ConfigId<A[\"namespace\"]>>;\n  };\n  /** Create only the application subject. Runs inside the owning auth SQL transaction;\n   * use that SqlClient (including Drizzle over it), and return the new subject ID.\n   * Do not perform external side effects or open an independent transaction here.\n   */\n  readonly Provisioning: Context.Service<ProvisioningRequirement<A>, Provisioning<A>>;\n  /** Capture dependencies at acquisition; validate SQL metadata and configure storage\n   * once on the first service operation. Initialization failures become that port's\n   * unavailable error. Failure or interruption remains cached until layer reacquisition.\n   */\n  readonly layer: Layer.Layer<\n    Ports<C, Id, A>,\n    PersistenceConfigurationError,\n    | Crypto.Crypto\n    | ConfigId<A[\"namespace\"]>\n    | ProvisioningRequirement<A>\n    | PasskeyRequirement<A>\n    | SqlClient.SqlClient\n    | R\n  >;\n  readonly managed: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables?: Partial<Record<Roles<C, Id, A>, T>>;\n    /** Stable SQL identifier prefix; reuse the deployed prefix for existing tables. */\n    readonly prefix: string;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n  readonly map: <N, Instant = number>(options: {\n    readonly subjects: SubjectOptions<T, N>;\n    readonly tables: Readonly<Record<Roles<C, Id, A>, T>>;\n    readonly timestamps?: TimestampOptions<Instant>;\n  }) => StorageLayout<T, Roles<C, Id, A>>;\n}\n\n/** Shared configuration shape. The backend chooses table types and service requirements. */\nexport interface PersistenceApi<T extends object, R = never> {\n  readonly make: <\n    C extends ClaimsCodec,\n    const Id extends string,\n    const A extends Definition<C, Id>,\n  >(\n    auth: A & Definition<C, Id>,\n  ) => BoundPersistence<T, R, C, Id, A>;\n}\n"],"mappings":";;AA+BA,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,QAAQ,OAAO,OAAO,CAC1B,CAAC,CAAC,CAAC"}

package/dist/internal/crypto.d.mts

@@ -0,0 +1 @@
+import { Crypto, Effect } from "effect";

package/dist/internal/crypto.mjs

@@ -1,6 +1,6 @@
 import { Crypto, Effect } from "effect";
-import { TokenDigest } from "@yielded/auth/Schema";
 import { Base64Url } from "effect/encoding";
+import { TokenDigest } from "@yielded/auth/Schema";
 //#region src/internal/crypto.ts
 const encoder = new TextEncoder();
 const randomId = Effect.flatMap(Crypto.Crypto, (crypto) => crypto.randomBytes(32).pipe(Effect.map(Base64Url.encode)));

package/dist/internal/d1-planning.mjs

@@ -0,0 +1,8 @@
+//#region src/internal/d1-planning.ts
+/** A false predicate aborts the current D1 batch; checking its result after
+* batch completion would be too late to roll the protected mutation back. */
+const sqlBatchAssertion = (sql, condition) => sql`select case when ${condition} then 1 else json_extract('[]', '$[auth-batch-precondition]') end as valid`;
+//#endregion
+export { sqlBatchAssertion };
+
+//# sourceMappingURL=d1-planning.mjs.map

package/dist/internal/d1-planning.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1-planning.mjs","names":[],"sources":["../../src/internal/d1-planning.ts"],"sourcesContent":["import type { SqlClient } from \"effect/sql/SqlClient\";\nimport type { Fragment } from \"effect/sql/Statement\";\n\n/** A false predicate aborts the current D1 batch; checking its result after\n * batch completion would be too late to roll the protected mutation back. */\nexport const sqlBatchAssertion = (sql: SqlClient, condition: Fragment) =>\n  sql`select case when ${condition} then 1 else json_extract('[]', '$[auth-batch-precondition]') end as valid`;\n"],"mappings":";;;AAKA,MAAa,qBAAqB,KAAgB,cAChD,GAAG,oBAAoB,UAAU"}